Malicious PDF — malware analysis report

Static analysis result for SHA-256 62582932d40add05…

MALICIOUS

PDF

32.6 KB Created: 2018-06-11 09:32:46 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 2702796e21c54bf89bd2d1abc49874d1 SHA-1: fc9bc1e11ee993e2b33b290f3e915589027e2e03 SHA-256: 62582932d40add057cf3cb68f8b86e9cf9c69fdbdb5f134eee379d8dc8799ffd
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains heuristics indicating it is a fake download lure, specifically designed for SEO poisoning. It embeds external URIs pointing to download URLs, such as http://uncpbisdegree.com/download3.php?q=workshop-manual-selespeed.pdf, which are likely intended to deliver a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9202

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=workshop-manual-selespeed.pdf
    • http://uncpbisdegree.com/download4.php?q=workshop-manual-selespeed.pdf
    • http://burnscamp.org.uk/3/3/2013-ford-explorer-ebooks-manual.pdf
    • http://www.unitedstates-history.org/di/ca/distributor-cap-diagrams-user-manuals.pdf
    • http://www.koalacars.com.au/
    • http://www.alfasportivo.com.sg/
    • http://www.alfaromeo-club.com/model/alfa-romeo-156-5
    • http://www.oldclassiccar.co.uk/modernads_make/fiat.htm
    • http://www.wolfbane.com/tv.htm
    • http://riverside-resort.net/1/unity-game-development-in-24-hours-sams-teach-yourself-sams-teach-yourself-in-24-hours.pdf
    • http://uncpbisdegree.com/1/storyworks-answer-key-april-2015.pdf
    • http://riverside-resort.net/1/what-is-a-tragic-hero.pdf
    • http://uncpbisdegree.com/1/stiffness-method-structural-analysis-examples.pdf
    • http://uncpbisdegree.com/1/sydney-omarr-day-by-day-astrological-guide-gemini-may-21-june-20.pdf
    • http://riverside-resort.net/1/wiring-double-switch-2-lights.pdf
    • http://uncpbisdegree.com/1/technology-n3-question-paper-2018.pdf
    • http://uncpbisdegree.com/1/small-animal-dermatology-7th-edition.pdf
    • http://uncpbisdegree.com/1/sexuality-meaning-myth-and-practice-vol-19.pdf
    • http://uncpbisdegree.com/1/solution-stoichiometry-lab-report.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://www.manualslib.com/manual/542291/Alfa-Romeo-147.html
    • https://www.manualslib.com/brand/alfa-romeo/
    • https://www.manualslib.com/brand/alfa-romeo/automobile.html
    • https://www.manualslib.com/products/Alfa-Romeo-147-2980017.html
    • https://en.wikipedia.org/wiki/Alfa_Romeo_105/115_Series_Coup%C3%A9s
    • https://www.pelicanparts.com/BMW/techarticles/E36-DME-Repair/E36-DME-Repair.htm
    • https://www.pelicanparts.com/BMW/index-SC.htm
    • https://www.pelicanparts.com/BMW/techarticles/tech_main_e30.htm
    • http://go.microsoft.com/fwlink/?LinkID=617350
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000042d1.bin
4ef5ed3312e7998e2ab5e6461ac7b9e82436faf737b3bc185851ad7d3087b021		 pdf-font-stream PDF embedded font (sfnt) at offset 0x42D1 11020 bytes
font_01_sfnt_off000065a9.bin
117a6636aac08d6dfc95c0df58484e9088c0a8a32ed7b20fa1ced72fd2034729		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65A9 6852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.